I've been asked to solve this security problem, as an exercise, but I have some difficulties.
Some notation:
- C1 means Computer1
- S1 means Server1,
- TA means Trusted Autentication system,
- X -> Y | Z means X sends message Z to Y,
- K_X,Y(m) means that m is ciphered with the symmetric key shared by X and Y.
Suppose you have C1 who wants to be identified by S1 using a TA, the protocol works as follows:
- C1 -> S1 | C1
- S1 -> C1 | nonce1
- C1 -> S1 | K_C1,TA(nonce1)
- S1 -> TA | K_S1,TA(C1, K_C1,TA(nonce1))
- TA -> S1 | K_S1,TA(nonce1)
Why is this not secure? Maybe because C1 sends it's identity as a plaintext to S1, and Eve could try to fake her identity using C1's, using the replay attack? Or what else?